Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-5VX9-J5CW-47VQ
Vulnerability from github – Published: 2023-02-17 18:30 – Updated: 2023-03-01 01:35
VLAI
Summary
Privilege escalation in MOSN
Details
Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "mosn.io/mosn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-32163"
],
"database_specific": {
"cwe_ids": [
"CWE-178",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-17T20:47:37Z",
"nvd_published_at": "2023-02-17T18:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.",
"id": "GHSA-5vx9-j5cw-47vq",
"modified": "2023-03-01T01:35:47Z",
"published": "2023-02-17T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32163"
},
{
"type": "WEB",
"url": "https://github.com/mosn/mosn/issues/1633"
},
{
"type": "WEB",
"url": "https://github.com/mosn/mosn/pull/1637"
},
{
"type": "PACKAGE",
"url": "https://github.com/mosn/mosn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Privilege escalation in MOSN"
}
GHSA-5W89-2C2X-6X66
Vulnerability from github – Published: 2026-04-08 03:32 – Updated: 2026-07-09 15:31
VLAI
Details
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-27140"
],
"database_specific": {
"cwe_ids": [
"CWE-641",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T02:16:02Z",
"severity": "HIGH"
},
"details": "SWIG file names containing \u0027cgo\u0027 and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.",
"id": "GHSA-5w89-2c2x-6x66",
"modified": "2026-07-09T15:31:57Z",
"published": "2026-04-08T03:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27140"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27140.json"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4871"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"type": "WEB",
"url": "https://go.dev/issue/78335"
},
{
"type": "WEB",
"url": "https://go.dev/cl/763768"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456341"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-27140"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34099"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25182"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23246"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16698"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16697"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16694"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16498"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16497"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16494"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16024"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16021"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10219"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10217"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5W9G-VRJ4-XWGH
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-07-13 00:01
VLAI
Details
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-29751"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-28T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.",
"id": "GHSA-5w9g-vrj4-xwgh",
"modified": "2022-07-13T00:01:17Z",
"published": "2022-05-24T19:06:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29751"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6467055"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5W9H-X2V4-5XM7
Vulnerability from github – Published: 2022-11-19 00:30 – Updated: 2022-11-24 06:30
VLAI
Details
Carel Boss Mini 1.5.0 has Improper Access Control.
Severity
9.9 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-34827"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-18T23:15:00Z",
"severity": "CRITICAL"
},
"details": "Carel Boss Mini 1.5.0 has Improper Access Control.",
"id": "GHSA-5w9h-x2v4-5xm7",
"modified": "2022-11-24T06:30:20Z",
"published": "2022-11-19T00:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34827"
},
{
"type": "WEB",
"url": "https://github.com/mandiant/Vulnerability-Disclosures"
},
{
"type": "WEB",
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0040/MNDT-2022-0040.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WG2-J2CF-G3Q5
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43
VLAI
Details
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2021-26964"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-05T17:15:00Z",
"severity": "HIGH"
},
"details": "A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.",
"id": "GHSA-5wg2-j2cf-g3q5",
"modified": "2022-05-24T17:43:46Z",
"published": "2022-05-24T17:43:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26964"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5WJ5-87VQ-39XM
Vulnerability from github – Published: 2026-04-09 17:35 – Updated: 2026-06-08 23:24
VLAI
Summary
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
Details
Impact
Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement.
A previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path.
OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<=2026.4.5 - Patched versions:
2026.4.8
Fix
The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
Verification
The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.
Credits
Thanks @zsxsoft and @KeenSecurityLab for reporting.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42432"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-09T17:35:53Z",
"nvd_published_at": "2026-04-28T19:37:47Z",
"severity": "HIGH"
},
"details": "## Impact\n\nNode Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement.\n\nA previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path.\n\nOpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c=2026.4.5`\n- Patched versions: `2026.4.8`\n\n## Fix\n\nThe issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.\n\n## Verification\n\nThe fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.\n\n## Credits\n\nThanks @zsxsoft and @KeenSecurityLab for reporting.",
"id": "GHSA-5wj5-87vq-39xm",
"modified": "2026-06-08T23:24:37Z",
"published": "2026-04-09T17:35:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5wj5-87vq-39xm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42432"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-command-escalation-via-node-pairing-reconnect-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement"
}
GHSA-5WJX-CXQM-P8R4
Vulnerability from github – Published: 2026-06-30 21:31 – Updated: 2026-06-30 21:31
VLAI
Details
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-7663"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T20:17:31Z",
"severity": "CRITICAL"
},
"details": "IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.",
"id": "GHSA-5wjx-cxqm-p8r4",
"modified": "2026-06-30T21:31:44Z",
"published": "2026-06-30T21:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7663"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7277570"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5WV5-M844-Q857
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-07-13 00:00
VLAI
Details
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-4495"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-02T21:15:00Z",
"severity": "HIGH"
},
"details": "IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114.",
"id": "GHSA-5wv5-m844-q857",
"modified": "2022-07-13T00:00:51Z",
"published": "2022-05-24T19:03:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4495"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182114"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6457739"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WVF-7FQ8-M4W6
Vulnerability from github – Published: 2024-08-07 12:31 – Updated: 2025-03-17 09:31
VLAI
Details
Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-7266"
],
"database_specific": {
"cwe_ids": [
"CWE-286",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T11:15:46Z",
"severity": "HIGH"
},
"details": "Incorrect User Management vulnerability in Naukowa i Akademicka Sie\u0107 Komputerowa - Pa\u0144stwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations.\u00a0This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17 before 17.2.",
"id": "GHSA-5wvf-7fq8-m4w6",
"modified": "2025-03-17T09:31:01Z",
"published": "2024-08-07T12:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7266"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2024/08/CVE-2023-7265"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2024/08/CVE-2024-7265"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2024/08/CVE-2023-7265"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2024/08/CVE-2024-7265"
},
{
"type": "WEB",
"url": "https://www.gov.pl/web/ezd-rp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:D/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-5WW6-4GGH-RHRP
Vulnerability from github – Published: 2025-05-06 03:30 – Updated: 2025-05-06 03:30
VLAI
Details
The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales_user_signup_form' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for unauthenticated attackers to create new user accounts, which can be leveraged with CVE-XX to achieve privilege escalation.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-3609"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-06T03:15:17Z",
"severity": "MODERATE"
},
"details": "The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the \u0027reales_user_signup_form\u0027 AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for unauthenticated attackers to create new user accounts, which can be leveraged with CVE-XX to achieve privilege escalation.",
"id": "GHSA-5ww6-4ggh-rhrp",
"modified": "2025-05-06T03:30:25Z",
"published": "2025-05-06T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3609"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f3250f-39a1-4ba1-b9a2-222926635ca0?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.